Zstandard

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Minimum award, where Meta pays a bounty at all │ $500 │ $625 Maximum: discretionary, no published ceiling for open source │ not published │ not published Submit a vulnerability CVE history 0 Last 12 months 4 Lifetime Memory safety 40 % Access control 25 % Denial of service 20 % Parsing/validation 10 % Latest advisories Loading the feed Overview Zstandard is Meta's compression library and one of the most widely reachable pieces of code in this entire study. It is a published IETF standard (RFC 8878), a registered HTTP Content-Encoding token supported by Chrome, Firefox and Edge, and a compressor built into the Linux kernel for btrfs, squashfs, zram and the kernel image itself. It is the payload format for Debian .deb packages, Arch pacman packages and Fedora RPM payloads, and it sits inside ZFS, PostgreSQL WAL compression, Kafka, Hadoop and effectively every modern object store. A decompressor bug here is reachable from untrusted input on a very large fraction of all Linux machines and in all three major browsers, which is why only four CVEs in a decade reads as a hard target rather than an unexamined one: zstd has been continuously fuzzed since 2016. Meta pays cash for a report through its own bug bounty: the published minimum is $500, Meta determines severity, and Meta publishes no payout guideline covering open source, so there is no maximum award you can point at in advance. sorona.xyz adds 1.25× on top of whatever Meta awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Meta's scope table names https://github.com/facebook/ as an eligible code-repo prefix, so the whole of facebook/zstd is in scope, and zstd's own SECURITY.md points at the same program. Meta determines severity itself and publishes no ceiling for an open-source target. The decompression library: frame and block parsing, the Huffman and FSE entropy decoders, the sequence and match-copy loops, and the streaming and single-shot APIs wrapped around them The compression library: the match finders at every level, the long-distance matcher, the row-hash and binary-tree strategies, and the multithreaded compressor Dictionary support on both sides, covering the COVER and fastCover trainers, dictionary loading through the API, and frames that reference a dictionary by ID The zstd command line tool and its helpers: file handling, output permissions, temporary files, --patch-from , --train and argument parsing The legacy-format decoders, which still accept frames written by every zstd version back to v0.1 The contributed formats and wrappers shipped in the repository, including the seekable format, pzstd , the zlib compatibility wrapper, and the freestanding and Linux-kernel builds the kernel's own zstd is generated from The build, test and release tooling in the repository, the place a supply-chain finding against a library this widely redistributed would live Out of scope Repositories outside the two eligible code-repo prefixes; the same scope row names https://github.com/facebookarchive/ as ineligible, and archiving a Meta repo removes it from scope Bugs that actually live in a project that embeds zstd rather than in zstd itself, which belong with that project's own program Compression ratio, throughput and interoperability complaints that carry no security consequence Extremely low-risk issues, which Meta states outright may not qualify for a bounty at all Findings with no demonstrated impact on Meta users or systems, which Meta scores low however widely deployed the library is Issues that require the attacker to already control the local machine or the build of the library, which sit inside the trust boundary rather than across it Duplicates, since only the first reporter of an issue is paid Awards blocked by sanctions screening, since Meta confirms every bounty is permitted under US trade sanctions and economic restrictions Most-valued findings Remote, unauthenticated memory corruption in the decompressor driven purely by attacker-supplied bytes. Memory safety is 40% of zstd's recorded history, CVE-2022-4899 is the buffer-overflow precedent, and this is the only class with a clear route to the top of Meta's discretionary band. A decoder bug reachable through the browser Content-Encoding: zstd path, which turns a library flaw into a drive-by surface in Chrome, Firefox and Edge at once Anything reachable from kernel-side zstd (btrfs, squashfs, zram or the compressed kernel image), where decompression happens in ring 0 on bytes the attacker chose Package-manager reachability: a malformed payload inside a .deb , pacman or RPM archive that corrupts memory while the package is being unpacked Local access-control failures in the command line tool that expose plaintext through file permissions or temporary files, the class CVE-2021-24031 and CVE-2021-24032 already produced here Concurrency defects in the multithreaded and one-pass compression paths, the shape of CVE-2019-11922 Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File through the report form at bugbounty.meta.com; Meta asks that you not contact its staff directly or through any other channel about a report Awards are entirely at Meta's discretion and Meta determines severity: no published payout guideline covers open source Duplicates pay only the first reporter Meta scores a report on impact to Meta users and systems, so a zstd bug with no demonstrated Meta-side impact is rated low even though the repository is plainly in scope Only repositories under https://github.com/facebook/ and https://github.com/facebookincubator/ are eligible: facebook/zstd qualifies under the first, while lz4/lz4 , same author, different GitHub org, matches neither Awards are subject to sanctions screening; Meta verifies that every bounty is permitted under US trade sanctions and economic restrictions Disclosure Coordinated with Meta, on Meta's clock. Its terms ask for reasonable time to investigate and mitigate before you disclose publicly or share the report with others, Meta alone judges what is reasonable, and Meta reserves the right to publish reports and their updates itself. Because that clause reaches private transfer as well as publication, file with Meta directly first. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability